]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
fs/ntfs3: add depth limit to indx_find_buffer to prevent stack overflow
authorMichael Bommarito <michael.bommarito@gmail.com>
Mon, 13 Apr 2026 13:31:17 +0000 (09:31 -0400)
committerKonstantin Komarov <almaz.alexandrovich@paragon-software.com>
Thu, 30 Apr 2026 11:55:07 +0000 (13:55 +0200)
commit1ebd684b8f627f75bc3e03f8b2ad8400fd1f02cd
treeacf352cacab62a921ecc6a958bfd6d2778df2a09
parent254f49634ee16a731174d2ae34bc50bd5f45e731
fs/ntfs3: add depth limit to indx_find_buffer to prevent stack overflow

indx_find_buffer() recursively descends the B+ tree index with no depth
limit.  A crafted NTFS image with circular index node references causes
unbounded recursion, overflowing the kernel stack and panicking the
system.

This is reachable by mounting a malicious NTFS filesystem (e.g. from a
USB drive via desktop automount) and deleting a file whose index entry
triggers the rebalancing fallback path in indx_delete_entry().

Add a depth parameter and bail out with -EINVAL when it reaches the
fnd->nodes array bound, matching the constraint already enforced by
fnd_push() in indx_find().

The related function indx_find() was previously patched for a similar
infinite-loop issue (commit 1732053c8a6b), but indx_find_buffer() was
missed.

Fixes: 82cae269cfa9 ("fs/ntfs3: Add initialization of super block")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-6
Assisted-by: Codex:gpt-5-4
Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
Signed-off-by: Konstantin Komarov <almaz.alexandrovich@paragon-software.com>
fs/ntfs3/index.c